CVE-2024-8252
Published: 30 August 2024
Summary
CVE-2024-8252 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Codection Clean Login. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Clean Login plugin for WordPress is vulnerable to local file inclusion in all versions through 1.14.5. The flaw exists in the clean-login-register shortcode, where the template attribute is processed without sufficient path validation, allowing an attacker to supply an arbitrary file path that is subsequently included and executed by the server.
Authenticated users with Contributor or higher privileges can exploit the issue over the network to include and run PHP files hosted on the server. This capability can be leveraged to bypass access controls, read sensitive data, or obtain code execution when an attacker can first upload a file containing PHP code disguised as an image or other permitted type.
A fix addressing the vulnerable code paths in frontend.php and shortcodes.php was committed in changeset 3143241, and details are tracked in the Wordfence advisory for this CVE. The EPSS score has remained flat at its peak value of 0.4415 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49047
Vulnerability details
The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the clean-login-register shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above,…
more
to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.
Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.
Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Procedures can mandate supply-chain vetting and restrictions on functionality obtained from untrusted third-party or external control spheres.
Requires use of trusted sources and provenance tracking, tangibly limiting inclusion of functionality from untrusted control spheres.